Facilities wants a test that walks locked doors and badge controls at city hall, while IT wants network exploitation testing, and leadership wants both views combined. Which pentest-type framing matches those goals?
Select an answer to reveal the explanation.
Short Explanation
Pick the drill that matches the door you’re testing—badge doors, network offense, defense proving grounds, or the mixed 'everything together' run. Labels aren’t decoration; they steer the engagement.
Full Explanation
Penetration testing types should match engagement goals. Physical tests evaluate facilities intrusion paths such as locked doors and badge controls at city hall. Offensive tests simulate adversary exploitation against networks and applications. Defensive tests validate blue-team detection and response. Integrated tests combine perspectives so leadership sees how physical and technical controls interact. Choosing physical, offensive, defensive, or integrated styles to match the goal is the correct framing for mixed facilities and IT objectives.
Claiming only passive policy reading qualifies as penetration testing under SY0-701 is incorrect; pentesting involves authorized adversarial evaluation, not mere policy review. Treating physical, offensive, and defensive labels as interchangeable erases purpose and leads to poorly scoped contracts. Forbidding integrated testing whenever any physical controls exist on campus invents a restriction; integrated exercises are often exactly what campuses need.
Exam caveat: Memorize that pentest style follows objective—physical, offensive, defensive, integrated—rather than one universal method or a policy-reading substitute.
Operational check: write rules of engagement that name the selected style(s), in-scope buildings and networks, safety constraints for physical testing, notification paths, and success criteria (findings, detection metrics for defensive tests). Debrief facilities and IT together after integrated runs so door and network fixes are coordinated.